The title I think gets the point across. Lets focus solely on these hypothetical situations:

  • Basic Auth headers when making API calls with user:pass
  • Storing passwords in an SQL database

What makes this secure in any way when its easy to tell Base64 is Base64 & then just decode it?

  • Encoding an image into an ASCII stream? – miike3459 Feb 15 '19 at 23:47
  • 8
    What makes you think that base64 is used for security at all? It is not. – Greendrake Feb 15 '19 at 23:56
  • 2
    Why are you thinking that passwords are ever stored in a database using Base64? Is there something that made you think this might be acceptable? – AndrolGenhald Feb 15 '19 at 23:58
  • 4
    @CodeSpent I don't mean to nag, but you mentioned using SHA-256 to hash passwords before you edited the question. While better than merely encoding the plaintext, this is still pretty terrible. You can read here about how it's done properly, but most frameworks should provide an easy way to use Argon2, bcrypt, or at least PBKDF2. – AndrolGenhald Feb 16 '19 at 0:05
  • 1
    @CodeSpent Glad you came here to ask instead of assuming it was ok! You probably got downvoted because people come along every so often asking basic questions like this without doing much research beforehand. It looks like half your question is a duplicate of this, and the other half is a duplicate of this. – AndrolGenhald Feb 16 '19 at 0:15

I think you may have a misconception here; Base64 is not necessarily used to protect information. It has the advantage that it can convert mostly any type of byte encoding into a human-readable ASCII stream. This is extremely useful for sending, say, via email, like with an attachment or image in the email.

There's many cases where it's just used to mask information, but not necessarily protect it. For instance, if you view the source of, say, smore.com when logged in, you've got a whole bunch of hidden inputs that their servers use for stuff. They are encoded in Base64. One time I decoded some of this information. None of it was really bad - I mean, I was already logged in anyway. But it was just hidden so that others looking at your screen couldn't see it. I think there was also some special byte sequences in those, which may not be too friendly for POST requests.

So yes, I'd say it's useful as a low-level encoding used to convert byte streams into ASCII, and mask data from visibility, but not decoding.

  • Well put, thanks. So when an API uses Basic Auth, its not actually secure in transit at all, its more of an illusion of security? – CodeSpent Feb 15 '19 at 23:54
  • 3
    @CodeSpent Security comes from using TLS. Even if it were hashed client side, without TLS anyone snooping could just submit the hash as if it were a password. – AndrolGenhald Feb 15 '19 at 23:56
  • 1
    @CodeSpent Sometimes, yes. – miike3459 Feb 15 '19 at 23:56
  • 1
    @CodeSpent And if you appreciated my answer, you can mark it accepted if you feel it answered the question :) – miike3459 Feb 15 '19 at 23:56
  • Yes it does, thank you! I am clearly misunderstanding what Base64 is meant for, but this gives me the direction to learn more myself. – CodeSpent Feb 15 '19 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.